_call is a query directive used to sort the result set.
_call is a query directive used to execute playbook and return the original stack of data in the Search tab. _call directive is used to allow blocking and non-blocking calls to playbook entities. Here, playbook is a new entity type in DNIF which is used to store and allow direct console execution of queries.
Take a look at the example given below:
_fetch * from event where $Duration=2d limit 1 >>_call bug_testing test_playbook123
1. The _fetch query directive retrieves all fields for each event in the event index where $Duration is 2 days. It is then limited to 1 row. The output is as shown below:
2. In the pipelined query, the _call directive uses the package name bug_testing and playbook name test_playbook123. The output is as shown below:
The _call directive allows you to:
- Execute playbook which is having status as EXECUTABLE.
- Blocking and non-blocking calls to playbook entities. Entities include widgets, workbook, report, module, template email, etc.
- The execution of the playbook returns the original stack of data as the result.
- It does not return the result of the query execution mentioned inside the playbook.
The generic syntax of the _call directive is as shown below:
_call <package_slug> <playbook_slug>
package_slug: slug name of the package
playbook_slug: slug name of the playbook
slug_name means alias name which is used in DNIF Query Language (DQL).
NOTE: The _call directive is available only on latest DNIF version 8.7.0